23195 matches found
CVE-2021-29349
CVE-2021-29349 CVE-2021-29349 CSRF to remove all messages in Mahara 20.10 Payload and Credit https://github.com/0xBaz...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
Ozette Plugins - Cross-Site Request Forgery
An attacker can update, create, and remove the site's mobile redirects via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. id: CVE-2023-23897 info: name: Ozette Plugins - Cross-Site Request Forgery author: popcorn94 severity: medi...
cve-2019-9787_csrf_poc
CVE-2019-9787 CSRF PoC Resumen PoC de CVE-2019-9787 CSRF WordPress versión 5.0 referencia No uses esto excepto con fines de prueba. Instalación $ docker-compose up -d 1. accede a http://localhost:8080/ e instala WordPress. Solo tienes que crear una cuenta de administrador de WP. 2. accede a...
CVE-2023-45857-Demo
Demo to verify the behavior of Axios vulnerability CVE-2023-45857 1. Start with dev container 2. Run npm run dev in the app container 3. Access http://app.localhost 4. Verify that the cookie XSRF-TOKEN is set in the browser's developer tools The value is CREDENTIALTOKEN HttpOnly is false SameSite...
CVE-2020-23590
CVE-2020-23590 OPTILINK E-PON "MODEL NO: OP-XT71000N" with "HARDWARE VERSION: V2.2"; & "FIRMWARE VERSION: OPV3.3.1-191028" Vulnerability found in the "Optilink OP-XT71000N Hardware version: V2.2 , Firmware Version: OPV3.3.1-191028" which allow an unauthenticated remote attacker to conduct a...
CVE-2018-8718
Exploit Title : Jenkins mailer plugin CSRF Vulnerability - Send CSRF MAIL Date : 2018/06/05 Exploit Author : Yeom Geun Cheol Vendor Homepage : https://jenkins.io/ Software Link : https://updates.jenkins.io/download/plugins/mailer/1.20/mailer.hpi Version: Below Version 1.20 1.1 1.20 Tested on :...
CVE-2024-51435
bloodbank A simple csrf poc found on blood bank system v 1.0...
vertx-web-xsrf
Overview The CSRFHandlerImpl io.vertx.ext.web.handler.impl.CSRFHandlerImpl in Vert.x Web does not create CSRF Tokens that are unique per user session. A malicious website can still perform CSRF by obtaining a valid CSRF token and adding it to a HTML form and then submitting the form to the...
inference-gateway-PoC
inference-gateway: aviso de seguridad | ---|--- Investigador| Dostxodjayev Abdullox @squeeze440 Aviso| GHSA-5293-fcm6-fh8v CVE| CVE-2026-87009 CVSS 3.1| 5.4 Medio — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L Debilidad| CWE-352, CWE-306, CWE-346 Estado| Corregido en v0.46.0 Resumen :...
halo-cors-csrf-CVE-2026-67921
CVE-2026-67921: Halo CMS CORS Misconfiguration + CSRF Protection Bypass Combined Attack Summary A critical combined attack vulnerability exists in Halo CMS versions up to 2.25.4 due to two security misconfigurations: 1. CORS Misconfiguration : The CORS policy allows any origin with credentials:...
CVE-2025-70899
Este repositorio contiene la Prueba de Concepto que demuestra la vulnerabilidad de protección CSRF faltante en el Sistema de Registro de Cursos en Línea de PHPgurukul. 📄 Vea el PoC completo aquí: MissingCSRFprotectionpoc.md...
Astra Linux – Vulnerability in Zabbix
A authenticated user can create a link containing reflected JavaScript code on it for the discovery page and send it to other users. The payload can only be executed with a known CSRF token value of the victim, which is changed periodically and is difficult to predict...
Astra Linux – Vulnerability in etcd
A cross-site request forgery flaw was discovered in etcd 3.3.1 and earlier. An attacker can create a website that attempts to send a POST request to the etcd server and modify a key. Adding a key is done using a PUT operation, so it seems theoretically safe but PUT operations cannot be performed...
EUVD-2026-76198
Unauthenticated Cross Site Request Forgery CSRF in Site Kit by Google = 1.186.0 versions...
EUVD-2026-76204
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
CVE-2026-62133 WordPress RTMKit plugin <= 2.1.5 - Cross Site Request Forgery (CSRF) vulnerability
Subscriber Cross Site Request Forgery CSRF in RTMKit = 2.1.5 versions...
CVE-2026-62133
WordPress plugin RTMKit (part of the Rometheme for Elementor plugin) contains a Cross-Site Request Forgery (CSRF) vulnerability in versions 2.1.5 and earlier . The vulnerability can be triggered by a user with Subscriber level privileges and was discovered by MYUNGYONG LEE . The CVSS 3.1 base sco...
CVE-2026-84432 Concrete CMS 9 through 9.5.2 is vulnerable to CSRFin the Boards custom slot dialog controller
Concrete CMS 9 through 9.5.2 did not validate an anti-CSRF token in the Boards custom slot dialog controller concrete/controllers/dialog/board/customslot.php saveTemplate action. The action created a boardslotproxy Block and dispatched an AddCustomSlotToBoardCommand against a board instance while...